Sunday, March 27, 2011

IP Packet Structure: Part 1


IP Packet Structure

Each IP (Internet Protocol) packet consists of a header followed by a data field.  The header length can vary between 20 and 60 bytes, and the total size of the packet can be up to 65535 bytes.  Actually, many systems cannot handle packets as large as the protocol allows, and a working maximum size is 576 bytes.

IP HeaderData
The header must have 5 words (of 32 bits each) of defined contents, and may have up to 10 more words of optional information.

012345678910111213141516171819202122232425262728293031
VersionHeader
Words
Type of ServicePacket Bytes
Packet IDFlagsFragment Offset
Time To LiveProtocolHeader Checksum
Source IP Address
Destination IP Address
0 - 10 Option Words

Version

  • There are versions of packets at this level.  These descriptions apply to version 4.

Header words

  • This is the header size, measured in 32 bit words.  The minimum size is 5 words (required by the protocol), if there no options are included; the maximum size allowed by the field size is 15 words, giving space for 10 words of options.  RFC 0791 refers to this field as IHL ( Internet Header Length).

Type of Service

Packet Bytes

  • The field size allows packet sizes up to 65,535 bytes, but most networks cannot handle packets of the maximum size.  All parts of the internet are required to handle packets as long as 576 bytes.

Packet ID

  • An identifying value assigned by the sender to aid in assembling the fragments of a datagram.  RFC 791 refers to this field as "Identification".

Flags

  • 012
     0 DFMF
  • The first flag bit is reserved, and must be zero.
  • Second flag bit (DF): 0 = May Fragment, 1 = Don't Fragment..
  • Third flag bit (MF) 0 = Last Fragment, 1 = More Fragments.

Fragment Offset

  • The fragment offset is measured in units of 8 octets (64 bits).  The first fragment has offset zero.

Time To Live (TTL)

  • TTL is the nominal maximum time in seconds that the packet can exist on the network.  Each router handling the packet will decrease the TTL field by one, however, so for practical purposes the TTL is the maximum number of hops.  When TTL reaches 0, a router will discard the packet and sent an ICMP "time expired" message back to the packet source.

Protocol

The protocol field indicates the next level protocol used in the data portion of the IP packet.  The most common values are 6 (TCP) or 17 (UDP), but most have the 256 possible values have been assigned.  See Protocol Numbers from IANA.

Header Checksum

The exclusive OR of all 16 bit words in the header, including the header checksum, should be zero.  Each forwarding node verifies the incoming header, and recalculates the header checksum for the outgoing header.

Source IP Address

  • This is the 32 bit IP address of the originating node.

Destination IP Address

  • This is the 32 bit IP address of the terminating node.

No comments:

Post a Comment